3 ms·

The link that you put in your post is in it's entirety about how they are not tracking you and not logging these requests for each user. The quoted portion you

by esrauch 15y ago

The link that you put in your post is in it's entirety about how they are not tracking you and not logging these requests for each user. The quoted portion you mentioned is just pointing out that in order to get a count of the +1's on a page you have to send a request to google to see that count. There is no conceivable way for it to show information without requesting it first. This isn't some sneaky side effect of the button, it is literally just the only functionality of the extension. They will probably still patch this to at least have a setting to not display +1's on https websites, but I don't really see where all this tracking talk came from.

roryokane 15y ago
Google could still uniquely identify sites while protecting your privacy by sending a hash of the URL from your browser, rather than the full URL itself, and comparing that hash to the hashes of all +1ed sites. People are talking about tracking because Google hasn’t chosen to implement their extension like this.
- arebop 15y ago
  Would the hash scheme you have in mind be vulnerable to rainbow tables?
- eneveu 15y ago
  A problem with sending a hash of the URL, is that you cannot canonicalize the URL on the server side anymore. A simple example: the hash of "http://www.foo.com/bar/ http://www.foo.com/bar/ would differ from the hash of "http://www.foo.com/bar http://www.foo.com/bar. I guess you could do some canonicalization on the client-side, though...
- esrauch 15y ago
  I don't really understand how you imagine it to work. You want them to just have a huge dumb store of hash -> count mappings without them having any meaning? That would completely defeat the purpose of +1s, they couldn't put what +1s you had on your profile or use it for recommendations or whatever. Even if this was the case, it would be trivially easy for them to get the hash -> url mappings at any time since they already effectively crawl the entire internet or a daily or weekly basis, all they would have to do is add a single entry to the pipeline. If you are saying that they should have a database where the columns are (url, hash, count) and just have the browser send the hash, that is exactly the same as just encrypting the url, and the request is being sent of https. What sort of security do you think you would have from hashing that is lacking in SSL?

by esrauch 15y ago

roryokane 15y ago

Google could still uniquely identify sites while protecting your privacy by sending a hash of the URL from your browser, rather than the full URL itself, and comparing that hash to the hashes of all +1ed sites. People are talking about tracking because Google hasn’t chosen to implement their extension like this.

arebop 15y ago
Would the hash scheme you have in mind be vulnerable to rainbow tables?
eneveu 15y ago
A problem with sending a hash of the URL, is that you cannot canonicalize the URL on the server side anymore. A simple example: the hash of "http://www.foo.com/bar/ http://www.foo.com/bar/ would differ from the hash of "http://www.foo.com/bar http://www.foo.com/bar. I guess you could do some canonicalization on the client-side, though...
esrauch 15y ago
I don't really understand how you imagine it to work. You want them to just have a huge dumb store of hash -> count mappings without them having any meaning? That would completely defeat the purpose of +1s, they couldn't put what +1s you had on your profile or use it for recommendations or whatever. Even if this was the case, it would be trivially easy for them to get the hash -> url mappings at any time since they already effectively crawl the entire internet or a daily or weekly basis, all they would have to do is add a single entry to the pipeline. If you are saying that they should have a database where the columns are (url, hash, count) and just have the browser send the hash, that is exactly the same as just encrypting the url, and the request is being sent of https. What sort of security do you think you would have from hashing that is lacking in SSL?